Reapply "Add missing admin action files and navigation links"

This reverts commit 4d515bc400.

src/actions/email-verify.ts

@@ -31,10 +31,7 @@ export async function verificationToken(email: string): Promise<string> {
  * Constant-time check that `token` matches the expected digest for `email`.
  * Returns false on any length/format mismatch rather than throwing.
  */
-export async function isValidVerificationToken(
-  email: string,
-  token: string,
-): Promise<boolean> {
+export async function isValidVerificationToken(email: string, token: string): Promise<boolean> {
   if (!email || !token || !/^[a-f0-9]{64}$/i.test(token)) return false;
   const expected = await verificationToken(email);
   const a = Buffer.from(expected, "utf8");
@@ -45,18 +42,15 @@ export async function isValidVerificationToken(
 
 /**
  * Build the verification link + email and send it. No-ops gracefully when SMTP
- * is unconfigured (sendMail returns false). `userId` is accepted for a faithful
- * call signature, but the stateless token only needs the email.
+ * is unconfigured (sendMail returns false).
  */
-export async function sendVerification(userId: number, email: string): Promise<boolean> {
+export async function sendVerification(email: string): Promise<boolean> {
   const normalised = email.trim().toLowerCase();
   if (!normalised) return false;
 
   const token = await verificationToken(normalised);
   const base = env.APP_URL.replace(/\/+$/, "");
-  const link = `${base}/verify?token=${encodeURIComponent(token)}&email=${encodeURIComponent(
-    normalised,
-  )}`;
+  const link = `${base}/verify?token=${encodeURIComponent(token)}&email=${encodeURIComponent(normalised)}`;
 
   const hotelName = (await siteSettings.get("hotel_name", env.HOTEL_NAME)) ?? env.HOTEL_NAME;
 
@@ -75,16 +69,9 @@ export async function sendVerification(userId: number, email: string): Promise<b
     </div>
   `.trim();
 
-  // `userId` referenced so a faithful caller signature isn't flagged unused.
-  void userId;
-
   return sendMail(normalised, `Verify your email · ${hotelName}`, html);
 }
 
 function escapeHtml(s: string): string {
-  return s
-    .replace(/&/g, "&amp;")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;");
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }